I created a rollup job with this configuration:

Here's the mapping of the index that was created:
{
"mapping": {
"_doc": {
"_meta": {
"_rollup": {
"test": {
"cron": "0 * * * * ?",
"rollup_index": "test",
"groups": {
"date_histogram": {
"field": "utc_time",
"interval": "10m",
"time_zone": "UTC"
},
"terms": {
"fields": [
"geo.src",
"headings.keyword",
"id"
]
}
},
"id": "test",
"metrics": [
{
"field": "memory",
"metrics": [
"max",
"sum",
"min",
"avg"
]
},
{
"field": "utc_time",
"metrics": [
"max",
"min"
]
}
],
"index_pattern": "log*",
"timeout": "20s",
"page_size": 1000
}
},
"rollup-version": "7.0.0-alpha1"
},
"dynamic_templates": [
{
"strings": {
"match_mapping_type": "string",
"mapping": {
"type": "keyword"
}
}
},
{
"date_histograms": {
"path_match": "*.date_histogram.timestamp",
"mapping": {
"type": "date"
}
}
}
],
"properties": {
"_rollup": {
"properties": {
"id": {
"type": "keyword"
},
"version": {
"type": "long"
}
}
},
"geo": {
"properties": {
"src": {
"properties": {
"terms": {
"properties": {
"_count": {
"type": "long"
},
"value": {
"type": "keyword"
}
}
}
}
}
}
},
"headings": {
"properties": {
"keyword": {
"properties": {
"terms": {
"properties": {
"_count": {
"type": "long"
},
"value": {
"type": "keyword"
}
}
}
}
}
}
},
"id": {
"properties": {
"terms": {
"properties": {
"_count": {
"type": "long"
}
}
}
}
},
"memory": {
"properties": {
"avg": {
"properties": {
"_count": {
"type": "float"
},
"value": {
"type": "float"
}
}
},
"max": {
"properties": {
"value": {
"type": "float"
}
}
},
"min": {
"properties": {
"value": {
"type": "float"
}
}
},
"sum": {
"properties": {
"value": {
"type": "float"
}
}
}
}
},
"utc_time": {
"properties": {
"date_histogram": {
"properties": {
"_count": {
"type": "long"
},
"interval": {
"type": "keyword"
},
"time_zone": {
"type": "keyword"
},
"timestamp": {
"type": "date"
}
}
},
"max": {
"properties": {
"value": {
"type": "float"
}
}
},
"min": {
"properties": {
"value": {
"type": "float"
}
}
}
}
}
}
}
}
}
Here's what the wizard shows:

CC @jen-huang
I created a rollup job with this configuration:
Here's the mapping of the index that was created:
{ "mapping": { "_doc": { "_meta": { "_rollup": { "test": { "cron": "0 * * * * ?", "rollup_index": "test", "groups": { "date_histogram": { "field": "utc_time", "interval": "10m", "time_zone": "UTC" }, "terms": { "fields": [ "geo.src", "headings.keyword", "id" ] } }, "id": "test", "metrics": [ { "field": "memory", "metrics": [ "max", "sum", "min", "avg" ] }, { "field": "utc_time", "metrics": [ "max", "min" ] } ], "index_pattern": "log*", "timeout": "20s", "page_size": 1000 } }, "rollup-version": "7.0.0-alpha1" }, "dynamic_templates": [ { "strings": { "match_mapping_type": "string", "mapping": { "type": "keyword" } } }, { "date_histograms": { "path_match": "*.date_histogram.timestamp", "mapping": { "type": "date" } } } ], "properties": { "_rollup": { "properties": { "id": { "type": "keyword" }, "version": { "type": "long" } } }, "geo": { "properties": { "src": { "properties": { "terms": { "properties": { "_count": { "type": "long" }, "value": { "type": "keyword" } } } } } } }, "headings": { "properties": { "keyword": { "properties": { "terms": { "properties": { "_count": { "type": "long" }, "value": { "type": "keyword" } } } } } } }, "id": { "properties": { "terms": { "properties": { "_count": { "type": "long" } } } } }, "memory": { "properties": { "avg": { "properties": { "_count": { "type": "float" }, "value": { "type": "float" } } }, "max": { "properties": { "value": { "type": "float" } } }, "min": { "properties": { "value": { "type": "float" } } }, "sum": { "properties": { "value": { "type": "float" } } } } }, "utc_time": { "properties": { "date_histogram": { "properties": { "_count": { "type": "long" }, "interval": { "type": "keyword" }, "time_zone": { "type": "keyword" }, "timestamp": { "type": "date" } } }, "max": { "properties": { "value": { "type": "float" } } }, "min": { "properties": { "value": { "type": "float" } } } } } } } } }Here's what the wizard shows:
CC @jen-huang